CP
Product
cPanel
On CISA KEVExploited in the wildRansomware-linked
18
CVEs
1
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 7High 10Medium 1Low 0
Watch
Add cPanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41940 RansomwareIn wildKEV | 9.8 | Apr 29 | WebPros cPanel and WHM Authentication Bypass via Login Flow Affected: 11.40.0.0 before 11.86.0.41; 11.88.0.0 before 11.94.0.28; 11.96.0.0 before 11.102.0.39; 11.104.0.0 before 11.110.0.97; 11.112.0.0 before 11.118.0.63; 11.120.0.0 before 11.124.0.35; +5 more |
| CVE-2026-93698 | 9.9 | Oct 2 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin Affected: before 11.138.0.11; before 11.136.0.45; before 11.134.0.61; before 11.110.0.148 |
| CVE-2026-67401 | 9.9 | Sep 9 | A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component Affected: before 11.134.0.55; before 11.136.0.39; before 11.138.0.4; before 11.138.1.9; before 11.110.0.143 |
| CVE-2026-87899 | 9.4 | Sep 23 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges Affected: 11.120.0.0 before 11.134.0.57; 11.136.0.0 before 11.136.0.41; 11.138.0.0 before 11.138.0.8 |
| CVE-2026-58048 | 9.4 | Jul 31 | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context Affected: before 11.110.0.137; before 11.126.0.78; before 11.134.0.48; before 11.136.0.32; before 11.137.9999.99; before 11.118.0.71 |
| CVE-2026-93029 | 9.0 | Oct 2 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface Affected: before 11.138.0.11; before 11.136.0.45; before 11.134.0.61; before 11.110.0.148 |
| CVE-2026-93697 | 9.0 | Oct 2 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface Affected: before 11.138.0.11; before 11.136.0.45; before 11.134.0.61; before 11.110.0.148 |
| CVE-2026-65643 | 8.8 | Sep 1 | Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root Affected: before 11.110.0.141; 11.112.0.0 before 11.134.0.53; 11.136.0.0 before 11.136.0.37; 11.138.0.0 before 11.138.0.2; 11.138.1.0 before 11.138.1.7 |
| CVE-2026-29202 | 8.8 | May 8 | Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system… Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-29203 | 8.8 | May 8 | A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-29205 | 8.6 | May 13 | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.120.0.0 before 11.124.0.38 |
| CVE-2026-29201 | 8.6 | May 8 | Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-32993 | 8.3 | May 13 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response Affected: 11.132.0.0 before 11.132.0.32; 11.134.0.0 before 11.134.0.26; 11.136.0.0 before 11.136.0.10 |
| CVE-2026-68490 | 8.2 | Sep 23 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts Affected: 11.120.0.0 before 11.134.0.57; 11.136.0.0 before 11.136.0.41; 11.138.0.0 before 11.138.0.8 |
| CVE-2026-32992 | 8.2 | May 13 | SSL verification is disabled in the DNS Cluster system Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59 |
| CVE-2026-29206 | 8.1 | May 13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.124.0.0 before 11.124.0.38; +5 more |
| CVE-2026-32991 | 7.1 | May 13 | Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.124.0.0 before 11.124.0.38; +2 more |
| CVE-2026-58047 | 5.6 | Jul 31 | HTTP Smuggling in cPanel allows potential leak of credentials Affected: before 11.110.0.137; before 11.126.0.78; before 11.134.0.48; before 11.136.0.32; before 11.137.9999.99; before 11.118.0.71 |
Showing 18